Key Takeaways
- An investor using Hyperliquid lost approximately $550,000 in USDC after interacting with a fraudulent Google search advertisement
- DarcyAri from FlashRescue identified the incident through on-chain analysis
- The stolen assets were distributed among three separate attacker-controlled wallets
- Following notification, Google disabled the malicious advertiser’s account
- Trezor wallet users have also been recent targets of comparable phishing campaigns
On August 13, a cryptocurrency investor suffered losses totaling around $550,000 in USDC after becoming victim to a sophisticated phishing operation executed through a paid Google search advertisement.
DarcyAri, who co-founded the blockchain tracing company FlashRescue, shared on-chain evidence revealing three separate fund transfers from the victim’s account to wallets associated with the scammer.
The stolen cryptocurrency was divided across three outbound transfers: $27,500 sent to the first wallet, $82,500 routed to a second destination, and $440,020 directed to a third address.
The malicious advertisement redirected the trader to a counterfeit website mimicking Hyperliquid’s legitimate platform, where sensitive information such as login credentials or wallet permissions were presumably compromised.
Google verified that it deactivated the fraudulent advertiser’s account. A company representative stated that their systems prevent 99% of policy-breaking advertisements from appearing and that they eliminated more than 602 million fraudulent ads throughout the previous year.
Recurring Trend of Cryptocurrency Phishing via Sponsored Listings
This incident represents just one of multiple occasions where malicious advertisements have exploited crypto investors through Google’s search platform.
During April, cryptocurrency security organization SEAL reported successfully blocking 356 dangerous Google advertisement URLs across multiple weeks. A portion of these malicious links specifically targeted Hyperliquid users.
SEAL observed that threat actors frequently leverage hijacked advertiser credentials to circumvent Google’s automated verification processes.
The organization emphasized that malicious advertisements may remain active for mere minutes before successfully deceiving a victim, complicating swift removal efforts.
This Hyperliquid attack occurred shortly after a distinct operation that focused on Trezor customers. On August 7, Trezor released an alert regarding phishing domains appearing as sponsored listings when users searched for “Trezor wallet.”
Trezor cautioned that submitting recovery seed phrases on these fraudulent platforms could result in complete asset forfeiture.
In July, a different cryptocurrency holder lost $999,999 in USDT after authorizing a malicious token approval on Ethereum, as documented by Web3 security company Scam Sniffer.
Platform Expansion Remains Unaffected
Importantly, there is no evidence suggesting the Hyperliquid platform itself experienced any security breach.
User engagement on the exchange has demonstrated consistent expansion. The total count of active perpetual contract traders achieved a record high of 263,666 on August 6, based on data from HyperTracker analytics.
Active participant numbers have climbed from approximately 150,000 during early January 2026, with accelerated momentum observed throughout the spring and summer months.
The HYPE token delivered returns of 79.2% during the latest quarter, peaking at an all-time high of $76.90 on June 16 before settling at $66.04 by quarter’s end.
The phishing incident showed no impact on the platform’s technical infrastructure or its trajectory of user expansion.
Cryptocurrency participants are strongly encouraged to bypass sponsored search listings when navigating to trading platforms and to independently confirm website URLs before connecting digital wallets or submitting sensitive information.
The post Hyperliquid Trader Loses $550K to Malicious Google Ad Campaign appeared first on Blockonomi.
Source: https://blockonomi.com/hyperliquid-trader-loses-550k-to-malicious-google-ad-campaign/
Be the first to comment